60d944fc9d35d169fd198227eb7e9798433f4fbdd0fd6fe1a5ab19d5aa5951c7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03ba0d5523356aa0fd71fa7968f379b8_JaffaCakes118.exe
Size

351KB
MD5

03ba0d5523356aa0fd71fa7968f379b8
SHA1

da21a08cfdad488dd5efe50fc5d6968f177cb1ff
SHA256

60d944fc9d35d169fd198227eb7e9798433f4fbdd0fd6fe1a5ab19d5aa5951c7
SHA512

0b88231bb2b51008ceed877234bf299ef9d9e44544eb96650ea729e62311a7250751dbb5af62d99e149bd8edd305aef0d64fef0e108c068400129fe2cca514d2
SSDEEP

6144:78lhUbjntPDo/OQlpKz8O6KEO+MTKbJ4RQjjJxEI0Xh7PblyzY:Awt7oPaz8Vtxy4jFQ7jlys

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1340	ojam.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{95755545-556D-BCA0-9C8F-7F38517A653A} = "C:\\Users\\Admin\\AppData\\Roaming\\Yvto\\ojam.exe"	ojam.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2260 set thread context of 4544	2260	03ba0d5523356aa0fd71fa7968f379b8_JaffaCakes118.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03ba0d5523356aa0fd71fa7968f379b8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojam.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe
1340	ojam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1340	2260	03ba0d5523356aa0fd71fa7968f379b8_JaffaCakes118.exe	82
PID 2260 wrote to memory of 1340	2260	03ba0d5523356aa0fd71fa7968f379b8_JaffaCakes118.exe	82
PID 2260 wrote to memory of 1340	2260	03ba0d5523356aa0fd71fa7968f379b8_JaffaCakes118.exe	82
PID 1340 wrote to memory of 2652	1340	ojam.exe	44
PID 1340 wrote to memory of 2652	1340	ojam.exe	44
PID 1340 wrote to memory of 2652	1340	ojam.exe	44
PID 1340 wrote to memory of 2652	1340	ojam.exe	44
PID 1340 wrote to memory of 2652	1340	ojam.exe	44
PID 1340 wrote to memory of 2668	1340	ojam.exe	45
PID 1340 wrote to memory of 2668	1340	ojam.exe	45
PID 1340 wrote to memory of 2668	1340	ojam.exe	45
PID 1340 wrote to memory of 2668	1340	ojam.exe	45
PID 1340 wrote to memory of 2668	1340	ojam.exe	45
PID 1340 wrote to memory of 2788	1340	ojam.exe	48
PID 1340 wrote to memory of 2788	1340	ojam.exe	48
PID 1340 wrote to memory of 2788	1340	ojam.exe	48
PID 1340 wrote to memory of 2788	1340	ojam.exe	48
PID 1340 wrote to memory of 2788	1340	ojam.exe	48
PID 1340 wrote to memory of 3428	1340	ojam.exe	56
PID 1340 wrote to memory of 3428	1340	ojam.exe	56
PID 1340 wrote to memory of 3428	1340	ojam.exe	56
PID 1340 wrote to memory of 3428	1340	ojam.exe	56
PID 1340 wrote to memory of 3428	1340	ojam.exe	56
PID 1340 wrote to memory of 3604	1340	ojam.exe	57
PID 1340 wrote to memory of 3604	1340	ojam.exe	57
PID 1340 wrote to memory of 3604	1340	ojam.exe	57
PID 1340 wrote to memory of 3604	1340	ojam.exe	57
PID 1340 wrote to memory of 3604	1340	ojam.exe	57
PID 1340 wrote to memory of 3792	1340	ojam.exe	58
PID 1340 wrote to memory of 3792	1340	ojam.exe	58
PID 1340 wrote to memory of 3792	1340	ojam.exe	58
PID 1340 wrote to memory of 3792	1340	ojam.exe	58
PID 1340 wrote to memory of 3792	1340	ojam.exe	58
PID 1340 wrote to memory of 3884	1340	ojam.exe	59
PID 1340 wrote to memory of 3884	1340	ojam.exe	59
PID 1340 wrote to memory of 3884	1340	ojam.exe	59
PID 1340 wrote to memory of 3884	1340	ojam.exe	59
PID 1340 wrote to memory of 3884	1340	ojam.exe	59
PID 1340 wrote to memory of 3948	1340	ojam.exe	60
PID 1340 wrote to memory of 3948	1340	ojam.exe	60
PID 1340 wrote to memory of 3948	1340	ojam.exe	60
PID 1340 wrote to memory of 3948	1340	ojam.exe	60
PID 1340 wrote to memory of 3948	1340	ojam.exe	60
PID 1340 wrote to memory of 4028	1340	ojam.exe	61
PID 1340 wrote to memory of 4028	1340	ojam.exe	61
PID 1340 wrote to memory of 4028	1340	ojam.exe	61
PID 1340 wrote to memory of 4028	1340	ojam.exe	61
PID 1340 wrote to memory of 4028	1340	ojam.exe	61
PID 1340 wrote to memory of 3696	1340	ojam.exe	62
PID 1340 wrote to memory of 3696	1340	ojam.exe	62
PID 1340 wrote to memory of 3696	1340	ojam.exe	62
PID 1340 wrote to memory of 3696	1340	ojam.exe	62
PID 1340 wrote to memory of 3696	1340	ojam.exe	62
PID 1340 wrote to memory of 4436	1340	ojam.exe	64
PID 1340 wrote to memory of 4436	1340	ojam.exe	64
PID 1340 wrote to memory of 4436	1340	ojam.exe	64
PID 1340 wrote to memory of 4436	1340	ojam.exe	64
PID 1340 wrote to memory of 4436	1340	ojam.exe	64
PID 1340 wrote to memory of 644	1340	ojam.exe	76
PID 1340 wrote to memory of 644	1340	ojam.exe	76
PID 1340 wrote to memory of 644	1340	ojam.exe	76
PID 1340 wrote to memory of 644	1340	ojam.exe	76
PID 1340 wrote to memory of 644	1340	ojam.exe	76
PID 1340 wrote to memory of 2260	1340	ojam.exe	81

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2668

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2788

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3428
- C:\Users\Admin\AppData\Local\Temp\03ba0d5523356aa0fd71fa7968f379b8_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\03ba0d5523356aa0fd71fa7968f379b8_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Roaming\Yvto\ojam.exe
    "C:\Users\Admin\AppData\Roaming\Yvto\ojam.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1340
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd1feb7d4.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3604

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3792

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3884

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3948

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4028

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3696

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4436

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpd1feb7d4.bat

Filesize
271B

MD5
f348b1e5579b34a77c88c0cc39421741

SHA1
3cb7a4c8415aa08127d82a64cbfd20b06edbe9b4

SHA256
445bed568c6ea6d92ad127a5a9e5b5d5f1dffb0db1cc7d0f6f7ac42061bfd2e7

SHA512
d909f6d1ed50c73f055e85d523a0f94ed57ed2ea73960ae57d43fad55edd6fac4bc1692a8305a9d396d00d141d83bca555402e4b5ba6bd9fe007ebc192200887

Download Submit
C:\Users\Admin\AppData\Roaming\Yvto\ojam.exe

Filesize
351KB

MD5
d15cb066ad00b571474d5f381233d6d6

SHA1
906b5ee8931f16043f28aeff09891c3fef7f225e

SHA256
86c36b948ca19e80f0eda682ecfe2154a8c93ceab5f3a28a0e9ad9eb61aa0f4c

SHA512
c5226bcbb331748d90fb53d54fa3f3c1555fca10c040c91d94289a85e9c43dba580e08af50a840acc93be074677bb80f58a8902b93c4ddcbee02673e9a9bcdea

Download Submit
memory/1340-25-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1340-47-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1340-45-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1340-44-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1340-10-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1340-11-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2260-18-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2260-13-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2260-12-0x0000000002300000-0x0000000002347000-memory.dmp

Filesize
284KB

Download
memory/2260-33-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2260-32-0x0000000002210000-0x0000000002260000-memory.dmp

Filesize
320KB

Download
memory/2260-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2260-21-0x0000000002300000-0x0000000002347000-memory.dmp

Filesize
284KB

Download
memory/2260-19-0x0000000002300000-0x0000000002347000-memory.dmp

Filesize
284KB

Download
memory/2260-0-0x0000000002210000-0x0000000002260000-memory.dmp

Filesize
320KB

Download
memory/2260-17-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2260-16-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2260-15-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2260-14-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2260-20-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2260-3-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2260-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2260-4-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4544-42-0x0000000000770000-0x00000000007B7000-memory.dmp

Filesize
284KB

Download
memory/4544-37-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4544-39-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4544-38-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4544-35-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4544-34-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4544-40-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4544-41-0x0000000000770000-0x00000000007B7000-memory.dmp

Filesize
284KB

Download
memory/4544-36-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4544-24-0x0000000000770000-0x00000000007B7000-memory.dmp

Filesize
284KB

Download